Re: Cross Site Scripting exploitation via malformed files

<!-- 

On many webmail systems, when the JPG file is downloaded, 
then the script is executed (you can play with javascript, vbscript,...) 

It was verified under IE - XP SP2 

 -->

This doesn't seem to be correct [or even work for that matter].

1. As an attachment in the email and received in yahoo or hotmail, 
generally most others, it arrives as that, an attachment [Content-
Disposition: attachment; even if inline it would fail as below], which you 
then click for download and opening. IE6 XP SP2 there is a download 
warning [as there probably is pre-SP2], which if you accept and open the 
file, opens with the defeault graphic viewer on XP Windows Picture and Fax 
Viewer. Even creating the file locally and opening it with IE directly 
generates an empty image container.

2. Pre SP2 and even XP, IE would render the html or code intentionally 
placed in basically any file type sitting on a remote server. But that is 
old and quite well known should certainly be fixed by now.

Unless of course if something new has cropped up. Has it?



-- 
http://www.malware.com